System and method for incident detection with spatiotemporal thresholds estimated via nonparametric quantile regression

ABSTRACT

Systems and methods for incident detection are provided. A system for incident detection comprises a network including at least one detector for detecting events in the network, a detection module capable of processing data from the at least one detector, and a calibration module capable of calibrating a plurality of bands for the incident detection based on a plurality of decision variables, wherein the plurality of bands define thresholds that are time-varying for all measurement locations in the network, and the thresholds are estimated using nonparametric quantile regression.

TECHNICAL FIELD

The field generally relates to systems and methods for incidentdetection and, in particular, to systems and methods for incidentdetection based on decision-tree algorithms, with spatiotemporalthresholds on the variables that participate in the decision-tree,estimated via nonparametric quantile regression.

BACKGROUND

Automatic incident detection has become a relied on feature in commandcenter operations. While various automatic incident detection methodsare known, existing methods are unreliable due to excessive falsealerts. In the past, data availability was more limited. Today, with theavailability of better and more real-time data and systems that canoptimize and re-optimize model parameters on a reasonably frequentschedule (e.g., weekly), it is possible to develop better and morerobust methods for incident detection.

Since an important function of a command center is to respond toincidents, it is anticipated that the embodiments of the invention willbe an important aspect of a modern command center toolkit.

SUMMARY

In general, exemplary embodiments of the invention include systems andmethods for incident detection and, in particular, to systems andmethods for incident detection based on decision-tree algorithms, withspatiotemporal thresholds on the variables that participate in thedecision-tree, estimated via nonparametric quantile regression.

According to an exemplary embodiment of the present invention, a systemfor incident detection comprises a network including at least onedetector for detecting events in the network, a detection module capableof processing data from the at least one detector, and a calibrationmodule capable of calibrating a plurality of bands for the incidentdetection based on a plurality of decision variables, wherein theplurality of bands define thresholds that are time-varying for allmeasurement locations in the network, and the thresholds are estimatedusing nonparametric quantile regression.

According to an exemplary embodiment of the present invention, a methodfor incident detection, comprises designating a plurality of decisionvariables for incident detection, and calibrating a plurality of bandsfor the incident detection based on the decision variables, wherein theplurality of bands define thresholds that are time-varying for allmeasurement locations in a network, and the thresholds are estimatedusing nonparametric quantile regression.

According to an exemplary embodiment of the present invention, anarticle of manufacture comprises a computer readable storage mediumcomprising program code tangibly embodied thereon, which when executedby a computer, performs method steps for incident detection, the methodsteps comprising designating a plurality of decision variables forincident detection, and calibrating a plurality of bands for theincident detection based on the decision variables, wherein theplurality of bands define thresholds that are time-varying for allmeasurement locations in a network, and the thresholds are estimatedusing nonparametric quantile regression.

These and other exemplary embodiments of the invention will be describedor become apparent from the following detailed description of exemplaryembodiments, which is to be read in connection with the accompanyingdrawings.

BRIEF DESCRIPTION OF THE DRAWINGS

Exemplary embodiments of the present invention will be described belowin more detail, with reference to the accompanying drawings, of which:

FIG. 1 shows a decision tree for California algorithm 7.

FIG. 2 shows decision trees for a customized algorithm that is based ontwo decision variables from a single detector, according to an exemplaryembodiment of the invention.

FIG. 3 is a graph of decision-bands for shocks in occupancies based onnonparametric quantile regression for a measurement location in theurban road network of the center of a city, according to an embodimentof the present invention.

FIG. 4 is a flow diagram of a method for incident detection according toan exemplary embodiment of the present invention.

FIG. 5 is a high-level diagram of a system for incident detectionaccording to an exemplary embodiment of the present invention.

FIG. 6 illustrates a computer system in accordance with which one ormore components/steps of the techniques of the invention may beimplemented, according to an exemplary embodiment of the invention.

DETAILED DESCRIPTION OF EXEMPLARY EMBODIMENTS

Exemplary embodiments of the invention will now be discussed in furtherdetail with regard to systems and methods for incident detection and, inparticular, to systems and methods for incident detection withspatiotemporal thresholds estimated via nonparametric quantileregression. This invention may, however, be embodied in many differentforms and should not be construed as limited to the embodiments setforth herein.

Embodiments of the present invention provide methods and systems fordetermining thresholds in decision-tree based approaches for incidentdetection. For each decision variable, a location-specific band oftime-varying width is created using nonparametric quantile regression.Incident alarms and detections are characterized by the presence ofdecision-variable related data outside their bands. The embodiments ofthe present invention provide: a) calibration of an algorithm which isnot location specific; irrespective of the number of measurementlocations in a network (e.g., road network), with k decision variablesthe modeler needs to calibrate at most 2k+2 parameters; b) depending onthe chosen decision variables, the algorithm may distinguish betweenincidents that occur upstream or downstream with respect to ameasurement location; c) the proposed method accounts for possibleasymmetries in the distributions of the decision variables, in contrastwith previous approaches that construct bands based on multiples ofstandard deviations; d) the method is straightforward in itsimplementation, in contrast to approaches based on pattern recognitionand machine learning; furthermore it allows complete freedom with regardto the decision variables which can be arbitrary functions of variablesof the subject network (e.g., traffic).

Embodiments of the present invention are applicable to transportationnetworks, but are not limited thereto, and can be applied to othernetwork types as well, including, but not limited to spatiallydisaggregated data networks, water networks, electricity networks, etc.In connection with the transportation network example, in general,embodiments of the present invention take real-time traffic data andperform checks to determine whether alert(s) should be provided orcreated, and if the alert(s) persist at the next time traffic data isreceived, then it is determined whether a detection should be issued.

Embodiments of the present invention use, for example, detectors orsensors, which detect traffic levels. For example, and withoutlimitation, inductive loops, which are fixed and record the passage ofevery vehicle over the loop, and/or global positioning system (GPS) tagson vehicles that record speeds, can be used. However, the embodimentsare not limited to the above detection devices.

The term “occupancy” or “occupancy level” as used herein can refer to atraffic parameter recorded by the fixed sensors or detectors, and can bedefined as a percentage of time that a road is occupied over a giventime interval. For example, given a 5-minute interval, the occupancy isthe percentage of time over that 5-minute interval that the road isoccupied. Occupancy is used in connection with the embodiments of thepresent invention. As alternatives, other variables may be used, suchas, for example, speed.

The term “shock in occupancy” or “occupancy shock” as used herein canrefer to a temporal difference at a single location of an occupancy(e.g., occ_(t)−occ_(t-1)).

Incident detection algorithms based on traffic data from fixed sensorscan be classified into a relatively large number of classes. Some of theclassifications include, for example: a) comparative algorithms based ondecision-trees that use a set of decision variables and a set ofthresholds (e.g., location specific) to classify a traffic state in aparticular location as incident free, potential incident or incident; b)time-series approaches, based on accurate forecasting models of trafficvariables; in this case incident detection occurs when detectormeasurements deviate significantly from the corresponding forecastedvalues; and c) artificial intelligence algorithms typically based onfuzzy logic and/or neural networks.

Embodiments of the present invention relate to the comparativealgorithms based on decision-trees noted in a) above. An example of aknown comparative algorithm based on decision-trees is the Californiaalgorithm 7; its structure being depicted in FIG. 1. Decision treealgorithms as used herein are based on decision variables and thresholdson these decision variables.

DOCC denotes downstream occupancy observed at time t (i.e., occ_(t)^(d)), OCCDF represents a spatial difference in occupancies between aset of (upstream and downstream) detectors (i.e., occ_(t) ^(u)−occ_(t)^(d)) and OCCRDF is the relative spatial difference in occupancies(i.e., (occ_(t) ^(u)−occ_(t) ^(d))/occ_(t) ^(u)), where u and drepresent upstream and downstream, respectively. T1, T2 and T3 representthresholds for DOCC, OCCDF and OCCRDF, respectively, and the statevariable takes on four values: 0 (incident-free), 1 (potentialincident), 2 (incident occurred) and 3 (incident continuing).

Referring to FIG. 1, if state≧1 is determined to be true, following lineT (“true”), then an alarm for a potential incident has been detected,and it is queried whether there has been an alarm for the occurrence ofthe incident (state≧2), and if deemed true, it is further queriedwhether the relative spatial difference in occupancies OCCRDF is equalto or exceeds threshold T2 to conclude detection of a continuingincident 3, or if less than threshold T2 to conclude incident-free 0. Ifstate≧2 is not deemed to be true, following line F (‘false”), it isfurther queried whether the relative spatial difference in occupanciesOCCRDF is equal to or exceeds threshold T2 to conclude detection of apotential incident 2, or if less than threshold T2 to concludeincident-free 0. If state≧1 is determined to be false, then it isqueried whether a spatial difference in occupancies between a set ofupstream and downstream detectors OCCDF is equal to or exceeds thresholdT1. If no, there is a conclusion of “incident free” 0. If yes, then itis queried whether the relative spatial difference in occupancies OCCRDFis equal to or exceeds threshold T2. If no, there is a conclusion of“incident free” 0. If yes, then it is further queried whether downstreamoccupancy observed at time t DOCC is equal to or exceeds threshold T3.If no, there is a conclusion of “incident free” 0. If yes, there is aconclusion of detection of a potential incident 1.

Effective calibration of the above algorithm essentially requiressubstantial spatio-temporal variability in T1, T2 and T3. For instance,T2 is expected to differ substantially when a downstream detector isplaced in a bottleneck as opposed to the case when the bottleneck islocated upstream. A tedious calibration procedure is required for theeffective implementation of algorithms like the one presented above.

Embodiments of the present invention describe methods and systems thataim to eliminate the tedious calibration procedures by requiringcalibration for a small number of parameters while accounting for thespatiotemporal variability of the variables that are included in thedecision tree. More specifically, embodiments of the present inventionrelate to systems and methods of having location specific and temporallydynamic thresholds. For example, referring to the thresholds T1, T2 andT3 from FIG. 1, due to the tedious nature of the calibrationsprocedures, known methods utilize static location specific thresholdsfixed across all time intervals (e.g., a fixed occupancy level at alocation that is the same regardless of time), which are based on fixedquantiles of the traffic data. As per embodiments of the presentinvention, tedious calibration procedures are eliminated usingstatistical techniques described further below so that the thresholdsused are location specific and temporally dynamic. As a result,embodiments of the present invention, which utilize temporally dynamicthresholds, can optimize the traffic data and limit false alerts.

In accordance with an embodiment of the present invention, a method usesa decision tree algorithm that is based on data from a single detector.The algorithm uses two decision variables and is depicted in FIG. 2. Itis to be understood that embodiments of the present invention are notlimited to the decision tree algorithm shown in FIG. 2, and otherdecision tree algorithms having more or less variables may be used.Referring to FIG. 2, the two decision variables arediffocc=occ_(t)−occ_(t-1) representing shocks in occupancy observed attime t, and occ=occ_(t) representing observed occupancy level at time t.

In the case of FIG. 2, the variable state takes on 7 values: 0(incident-free), 1 (potential incident downstream), 2 (incidentidentified downstream), 3 (identified incident continuing downstream),−1 (potential incident upstream), −2 (incident identified upstream) and−3 (identified incident continuing upstream). An incident can be deemedto have occurred if data (e.g., occupancy) falls outside of specificband determined by the location specific and temporally dynamicthresholds. The algorithm looks for sufficiently large shocks inoccupancies which bring occupancy levels outside a band, to triggerdetection. Occupancy, specifically, shock in occupancy and occupancylevel, is used in this example as the decision variable because in somecases it can lead to superior detection performance when compared toother decision variables. However, the embodiments of the presentinvention are not limited to occupancy as the decision variable, andother variables, such as, for example, the ratio of volumes tooccupancies can be used.

According to embodiments of the present invention, calibration of thebands for incident detection is performed. The bands define thethresholds which vary based on the time of day. For each measurementlocation diffocc=occ_(t)−occ_(t-1), represents shocks in occupancyobserved at time t whereas occ=occ_(t) represents observed occupancylevels. In contrast to the algorithm described in connection with FIG.1, the thresholds in FIG. 2 are time-varying and for all measurementlocations of the network, based on six parameters (i.e., 2k+2, where kis the number of decision variables).

In accordance with embodiments of the present invention, a quantilerefers to a point from the cumulative distribution function (CDF) of thetraffic variable (occupancy, in this example). In other words, the kthoccupancy quantile is the value x such that the probability that theoccupancy is less than x is at most k/100 and the probability that theoccupancy exceeds x is at most 1−(k/100). The six parameters are definedas follows: τ₁, τ₂ (with τ₁<τ₂) are specific quantiles for shocks inoccupancies (see FIG. 3 where τ₁, τ₂ over time are represented by lowerand upper curves, respectively), τ₃, τ₄ (with τ₃<τ₄) are specificquantiles for occupancies and the last two parameters, denoted λ₁, λ₂,control the degree of smoothness of the functions, Q₁, Q₂. In accordancewith an embodiment of the present invention, functions, Q₁, Q₂ are timevarying.

Q₁(τ|t) is the conditional quantile function for shocks in occupancies,whereas Q₂(τ|t) is the conditional quantile function for levels ofoccupancies. These functions can be constructed using a knownnonparametric quantile regression framework, such as, for example, thenonparametric quantile regression framework presented in Koenker, R.,Quantile Regression, Chap. 7 (Cambridge University Press, 2005). Thewidth of the bands that are based on Q₁ and Q₂ depend on the difference(τ₂−τ₁) and (τ₄−τ₃), respectively, and the variability of thelocation-specific decision variables; hence width of the bands that arebased on Q₁ and Q₂, respectively, is time-dependent andlocation-specific.

FIG. 3 depicts an example of such decision bands, based on data from aparticular measurement location on an urban road network in the centerof a city. Specifically, FIG. 3 is a graph of decision-bands for shocksin occupancies based on nonparametric quantile regression for ameasurement location in the urban road network of the center of a city.The horizontal (x) axis represents a time of day, and the vertical (y)axis represents a size of a shock. The depicted traffic data correspondsto a 12-hour period that contains morning peak.

As can be observed, the width of the band (i.e., τ₂−τ₁) is substantiallyreduced during the early morning (to the left on the graph) asoccupancies display less variability during this period. Similarly, thecorresponding band for a measurement location with substantially morevariable traffic dynamics than the one shown in FIG. 3 would have beenwider.

Referring to FIG. 3, the points outside of the band (i.e., on top of andunder the curves) represent potential incidences, and points within thebands (i.e., between the curves) are points where shocks have not beentriggered.

Referring back to FIG. 2, if state≧1 is determined to be true, followingline T (“true”), then an alarm for a potential incident downstream hasbeen detected, and it is queried whether there has been an alarm for anincident identified downstream (state≧2), and if deemed true, it isfurther queried whether the observed occupancy level occ at a time texceeds the conditional quantile function for levels of occupanciesQ₂(τ₄|t) (i.e., falling outside the band) to conclude detection of anidentified incident continuing downstream 3, or if less than thistemporally dynamic threshold to conclude incident-free 0 (i.e., fallinginside the band). If state≧2 is not deemed to be true, following line F(‘false”), it is further queried whether the observed occupancy levelocc at time t exceeds the conditional quantile function for levels ofoccupancies Q₂(τ₄|t) (i.e., falling outside the band) to concludedetection of an incident identified downstream 2, or if less than thistemporally dynamic threshold to conclude incident-free 0 (i.e., fallinginside the band). If state≧1 is determined to be false, then it isqueried whether a shock in occupancy observed at time tdiffocc=occ₁−occ_(t-1) is greater than the conditional quantile functionfor shocks in occupancies Q₁(τ₂|t) (i.e., falling outside the band). Ifno, there is a conclusion of incident-free 0. If yes, then it is queriedwhether the observed occupancy level occ at time t exceeds theconditional quantile function for levels of occupancies Q₂(τ₄|t) (i.e.,falling outside the band) to conclude detection of a potential incidentdownstream 1, or if less than this temporally dynamic threshold toconclude incident-free 0 (i.e., falling inside the band).

If state≦−1 is determined to be true, following line T (“true”), then analarm for a potential incident upstream has been detected, and it isqueried whether there has been an alarm for an incident identifiedupstream (state≦−2), and if deemed true, it is further queried whetherthe observed occupancy level occ at a time t is less than theconditional quantile function for levels of occupancies Q₂(τ₃|t) (i.e.,falling outside the band) to conclude detection of an identifiedincident continuing upstream −3, or if greater than this temporallydynamic threshold to conclude incident-free 0 (i.e., falling inside theband). If state≦−2 is not deemed to be true, following line F (‘false”),it is further queried whether the observed occupancy level occ at time tis less than the conditional quantile function for levels of occupanciesQ₂(τ₃|t) (i.e., falling outside the band) to conclude detection of anincident identified upstream −2, or if greater than this temporallydynamic threshold to conclude incident-free 0 (i.e., falling inside theband). If state≦−1 is determined to be false, then it is queried whethera shock in occupancy observed at time t diffocc=occ_(t)−occ_(t-1) isless than the conditional quantile function for shocks in occupanciesQ₁(τ₁|t) (i.e., falling outside the band). If no, there is a conclusionof incident-free 0. If yes, then it is queried whether the observedoccupancy level occ at time t is less than the conditional quantilefunction for levels of occupancies Q₂(τ₃|t) (i.e., falling outside theband) to conclude detection of a potential incident upstream −1, or ifgreater than this temporally dynamic threshold to conclude incident-free0 (i.e., falling inside the band).

A simplified approach of band construction based on fixed multiples oftime dependent standard deviations could be used. However, such a choicemay not lead to satisfactory results when the decision variables areasymmetric/skewed.

In accordance with an embodiment of the present invention, for adecision-tree algorithm that is based on k decision variables,calibration of at most 2k+2 parameters is required. In general, suchcalibration can be performed based on a set that contains both incidentand incident free traffic data. Given a maximum allowed false alarmrate, the chosen parameters can maximize detection rate. According to anembodiment of the present invention, a grid-search procedure can beinvoked to maximize detection rate. In the example displayed above, τ₃and τ₄ can be chosen to comply with a set of reported incidentdurations. Incident duration is dictated by occupancy levels that lieoutside their band after a significant shock has been detected. Lambdascan be chosen using a roughness penalty approach, as in Koenker (2005)and τ₁, τ₂ can be chosen so that the detection rate is maximized for agiven false alarm rate.

The illustrated methods according to embodiments of the presentinvention not only allow detection of an incident at its epicenter, butcan track the spatio-temporal evolution of incident effects. Inaddition, using the methods of the embodiments, with additionalquantiles, permits characterization of incidents in terms of severity.For example, given a detected incident from the decision trees presentedFIG. 2, if occ>{tilde over (τ)}₄ with {tilde over (τ)}₄>τ₄, incidenteffects may be characterized as severe for the specific time instant andat the specific location of the road network.

Referring to FIG. 4, a method for incident detection 400 according to anexemplary embodiment of the present invention includes designating aplurality of decision variables for incident detection (Step 402), andcalibrating a plurality of bands for the incident detection based on thedecision variables (Step 404). The plurality of bands define thresholdsthat are time-varying for all measurement locations in a network, andthe thresholds are estimated using nonparametric quantile regression.

Calibration is performed using 2k+2 parameters, and wherein k is thenumber of decision variables. The method further includes detectingoccurrence of an event at a time t (Step 406), and querying whether theevent falls outside a band of the plurality of bands to determinewhether an incident has occurred (Step 408). By determining whether anevent falls above or below a band, the determination of an occurrence ofa downstream incident and an occurrence of an upstream incident in thenetwork is performed using a same band. Querying whether the event fallsoutside a band of the plurality of bands is performed by queryingwhether the event is less than or greater than a conditional quantilefunction for a decision variable to determine whether the incident hasoccurred.

Referring to FIG. 5, a system 500 for incident detection according to anexemplary embodiment of the present invention comprises a network 501(e.g., traffic network) including detectors 502 for detecting events atvarious points (e.g., upstream and downstream portions on a road) in thenetwork 501, a detection module 504 capable of processing data from thedetectors 502, and a calibration module 508 capable of calibrating aplurality of bands for the incident detection based on a plurality ofdecision variables. The plurality of bands define thresholds that aretime-varying for all measurement locations in the network 501, and thethresholds are estimated using nonparametric quantile regression.

The calibration module 508 performs the calibration using 2k+2parameters, and wherein k is the number of decision variables. Thedetection module 504 processes the data from a detector to detectoccurrence of an event at a time t, and the system further comprises adetermination module 506 capable of querying whether the event fallsoutside a band of the plurality of bands to determine whether anincident has occurred. More specifically, the determination module 506queries whether the event is less than or greater than a conditionalquantile function for a decision variable to determine whether theincident has occurred. By determining whether an event falls above orbelow a band, the determination module 506 can use a same band of theplurality of bands to make a determination of an occurrence of adownstream incident and an occurrence of an upstream incident in thenetwork 501.

As will be appreciated by one skilled in the art, aspects of the presentinvention may be embodied as a system, apparatus, method, or computerprogram product. Accordingly, aspects of the present invention may takethe form of an entirely hardware embodiment, an entirely softwareembodiment (including firmware, resident software, micro-code, etc.) oran embodiment combining software and hardware aspects that may allgenerally be referred to herein as a “circuit,” “module” or “system.”Furthermore, aspects of the present invention may take the form of acomputer program product embodied in one or more computer readablemedium(s) having computer readable program code embodied thereon.

Any combination of one or more computer readable medium(s) may beutilized. The computer readable medium may be a computer readable signalmedium or a computer readable storage medium. A computer readablestorage medium may be, for example, but not limited to, an electronic,magnetic, optical, electromagnetic, infrared, or semiconductor system,apparatus, or device, or any suitable combination of the foregoing. Morespecific examples (a non-exhaustive list) of the computer readablestorage medium would include the following: an electrical connectionhaving one or more wires, a portable computer diskette, a hard disk, arandom access memory (RAM), a read-only memory (ROM), an erasableprogrammable read-only memory (EPROM or Flash memory), an optical fiber,a portable compact disc read-only memory (CD-ROM), an optical storagedevice, a magnetic storage device, or any suitable combination of theforegoing. In the context of this document, a computer readable storagemedium may be any tangible medium that can contain, or store a programfor use by or in connection with an instruction execution system,apparatus, or device.

A computer readable signal medium may include a propagated data signalwith computer readable program code embodied therein, for example, inbaseband or as part of a carrier wave. Such a propagated signal may takeany of a variety of forms, including, but not limited to,electro-magnetic, optical, or any suitable combination thereof. Acomputer readable signal medium may be any computer readable medium thatis not a computer readable storage medium and that can communicate,propagate, or transport a program for use by or in connection with aninstruction execution system, apparatus, or device.

Program code embodied on a computer readable medium may be transmittedusing any appropriate medium, including but not limited to wireless,wireline, optical fiber cable, RF, etc., or any suitable combination ofthe foregoing.

Computer program code for carrying out operations for aspects of thepresent invention may be written in any combination of one or moreprogramming languages, including an object oriented programming languagesuch as Java, Smalltalk, C++ or the like and conventional proceduralprogramming languages, such as the “C” programming language or similarprogramming languages. The program code may execute entirely on theuser's computer, partly on the user's computer, as a stand-alonesoftware package, partly on the user's computer and partly on a remotecomputer or entirely on the remote computer or server. In the latterscenario, the remote computer may be connected to the user's computerthrough any type of network, including a local area network (LAN) or awide area network (WAN), or the connection may be made to an externalcomputer (for example, through the Internet using an Internet ServiceProvider).

Aspects of the present invention are described herein with reference toflowchart illustrations and/or block diagrams of methods, apparatus(systems) and computer program products according to embodiments of theinvention. It will be understood that each block of the flowchartillustrations and/or block diagrams, and combinations of blocks in theflowchart illustrations and/or block diagrams, can be implemented bycomputer program instructions. These computer program instructions maybe provided to a processor of a general purpose computer, specialpurpose computer, or other programmable data processing apparatus toproduce a machine, such that the instructions, which execute via theprocessor of the computer or other programmable data processingapparatus, create means for implementing the functions/acts specified inthe flowchart and/or block diagram block or blocks.

These computer program instructions may also be stored in a computerreadable medium that can direct a computer, other programmable dataprocessing apparatus, or other devices to function in a particularmanner, such that the instructions stored in the computer readablemedium produce an article of manufacture including instructions whichimplement the function/act specified in the flowchart and/or blockdiagram block or blocks.

The computer program instructions may also be loaded onto a computer,other programmable data processing apparatus, or other devices to causea series of operational steps to be performed on the computer, otherprogrammable apparatus or other devices to produce a computerimplemented process such that the instructions which execute on thecomputer or other programmable apparatus provide processes forimplementing the functions/acts specified in the flowchart and/or blockdiagram block or blocks.

FIGS. 2-5 illustrate the architecture, functionality, and operation ofpossible implementations of systems, methods, and computer programproducts according to various embodiments of the present invention. Inthis regard, each block in a flowchart or a block diagram may representa module, segment, or portion of code, which comprises one or moreexecutable instructions for implementing the specified logicalfunction(s). It should also be noted that, in some alternativeimplementations, the functions noted in the block may occur out of theorder noted in the figures. For example, two blocks shown in successionmay, in fact, be executed substantially concurrently, or the blocks maysometimes be executed in the reverse order, depending upon thefunctionality involved. It will also be noted that each block of theblock diagram and/or flowchart illustration, and combinations of blocksin the block diagram and/or flowchart illustration, can be implementedby special purpose hardware-based systems that perform the specifiedfunctions or acts, or combinations of special purpose hardware andcomputer instructions.

One or more embodiments can make use of software running on ageneral-purpose computer or workstation. With reference to FIG. 6, in acomputing node 610 there is a computer system/server 612, which isoperational with numerous other general purpose or special purposecomputing system environments or configurations. Examples of well-knowncomputing systems, environments, and/or configurations that may besuitable for use with computer system/server 612 include, but are notlimited to, personal computer systems, server computer systems, thinclients, thick clients, handheld or laptop devices, multiprocessorsystems, microprocessor-based systems, set top boxes, programmableconsumer electronics, network PCs, minicomputer systems, mainframecomputer systems, and distributed cloud computing environments thatinclude any of the above systems or devices, and the like.

Computer system/server 612 may be described in the general context ofcomputer system executable instructions, such as program modules, beingexecuted by a computer system. Generally, program modules may includeroutines, programs, objects, components, logic, data structures, and soon that perform particular tasks or implement particular abstract datatypes. Computer system/server 612 may be practiced in distributed cloudcomputing environments where tasks are performed by remote processingdevices that are linked through a communications network. In adistributed cloud computing environment, program modules may be locatedin both local and remote computer system storage media including memorystorage devices.

As shown in FIG. 6, computer system/server 612 in computing node 610 isshown in the form of a general-purpose computing device. The componentsof computer system/server 612 may include, but are not limited to, oneor more processors or processing units 616, a system memory 628, and abus 618 that couples various system components including system memory628 to processor 616.

The bus 618 represents one or more of any of several types of busstructures, including a memory bus or memory controller, a peripheralbus, an accelerated graphics port, and a processor or local bus usingany of a variety of bus architectures. By way of example, and notlimitation, such architectures include Industry Standard Architecture(ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA)bus, Video Electronics Standards Association (VESA) local bus, andPeripheral Component Interconnects (PCI) bus.

The computer system/server 612 typically includes a variety of computersystem readable media. Such media may be any available media that isaccessible by computer system/server 612, and it includes both volatileand non-volatile media, removable and non-removable media.

The system memory 628 can include computer system readable media in theform of volatile memory, such as random access memory (RAM) 630 and/orcache memory 632. The computer system/server 612 may further includeother removable/non-removable, volatile/nonvolatile computer systemstorage media. By way of example only, storage system 634 can beprovided for reading from and writing to a non-removable, non-volatilemagnetic media (not shown and typically called a “hard drive”). Althoughnot shown, a magnetic disk drive for reading from and writing to aremovable, non-volatile magnetic disk (e.g., a “floppy disk”), and anoptical disk drive for reading from or writing to a removable,non-volatile optical disk such as a CD-ROM, DVD-ROM or other opticalmedia can be provided. In such instances, each can be connected to thebus 618 by one or more data media interfaces. As depicted and describedherein, the memory 628 may include at least one program product having aset (e.g., at least one) of program modules that are configured to carryout the functions of embodiments of the invention. A program/utility640, having a set (at least one) of program modules 642, may be storedin memory 628 by way of example, and not limitation, as well as anoperating system, one or more application programs, other programmodules, and program data. Each of the operating system, one or moreapplication programs, other program modules, and program data or somecombination thereof, may include an implementation of a networkingenvironment. Program modules 642 generally carry out the functionsand/or methodologies of embodiments of the invention as describedherein.

Computer system/server 612 may also communicate with one or moreexternal devices 614 such as a keyboard, a pointing device, a display624, etc., one or more devices that enable a user to interact withcomputer system/server 612, and/or any devices (e.g., network card,modem, etc.) that enable computer system/server 612 to communicate withone or more other computing devices. Such communication can occur viaInput/Output (I/O) interfaces 622. Still yet, computer system/server 612can communicate with one or more networks such as a local area network(LAN), a general wide area network (WAN), and/or a public network (e.g.,the Internet) via network adapter 620. As depicted, network adapter 620communicates with the other components of computer system/server 612 viabus 618. It should be understood that although not shown, other hardwareand/or software components could be used in conjunction with computersystem/server 612. Examples, include, but are not limited to: microcode,device drivers, redundant processing units, external disk drive arrays,RAID systems, tape drives, and data archival storage systems, etc.

Although illustrative embodiments of the present invention have beendescribed herein with reference to the accompanying drawings, it is tobe understood that the invention is not limited to those preciseembodiments, and that various other changes and modifications may bemade by one skilled in the art without departing from the scope orspirit of the invention.

1-7. (canceled)
 8. A method for incident detection, the methodcomprising: designating a plurality of decision variables for incidentdetection; and calibrating a plurality of bands for the incidentdetection based on the decision variables, wherein: the plurality ofbands define thresholds that are time-varying for all measurementlocations in a network; and the thresholds are estimated usingnonparametric quantile regression.
 9. The method according to claim 8,further comprising: detecting occurrence of an event at a time; andquerying whether the event falls outside a band of the plurality ofbands to determine whether an incident has occurred.
 10. The methodaccording to claim 9, wherein a determination of an occurrence of adownstream incident and an occurrence of an upstream incident in thenetwork is performed using a same band of the plurality of bands. 11.The method according to claim 8, wherein at least two thresholdsrespectively comprise upper and lower limits of a band of the pluralityof bands and a width of the band is variable over time.
 12. The methodaccording to claim 8, wherein the decision variables represent a shockin occupancy and an occupancy level at a time.
 13. The method accordingto claim 12, wherein calibration is performed using a plurality ofparameters, wherein first and second parameters are quantiles for shocksin occupancies, and third and fourth parameters are quantiles foroccupancy levels.
 14. The method according to claim 13, wherein fifthand sixth parameters control a degree of smoothness for respectiveconditional quantile functions for the shocks in occupancies and theoccupancy levels.
 15. The method according to claim 8, furthercomprising: detecting occurrence of an event at a time; querying whetherthe event is less than or greater than a conditional quantile functionfor a decision variable to determine whether an incident has occurred.16. The method according to claim 8, further comprising utilizingvariable state values representing both upstream and downstreamincidents in the network. 17-20. (canceled)